Destination not allowed

A spend was refused because the recipient isn't in the vault's committed allowlist.

#Symptom

A spend to a specific recipient address is refused, even though the amount is within all other limits.

#Why this happens

If the vault (or this specific agent) has a destination allowlist configured, the covenant rejects any spend to a recipient not cryptographically committed to that list — there is no way around this by trying a different amount, a different wording, or bypassing the PolicyVault app, because the allowlist check happens at the consensus layer, not just in the application.

#Checking what's actually allowed

The vault's dashboard page shows the currently configured allowlist (if any) for each agent. If you're not sure whether an address is on it, simulate the spend — the refusal reason will confirm whether the destination is the actual problem.

#Adding a new recipient

If a legitimate new recipient needs to be paid, the vault owner needs to update the allowlist — this requires rebuilding and re-committing the recipient set as a new owner-signed covenant operation. An agent or approver cannot add a recipient on their own.

#Double-check the exact address

A common non-obvious cause: the address you're trying to pay is correct but doesn't exactly match what's on the allowlist (a different address format, a typo, or an address belonging to the intended recipient's different account). The allowlist check is exact — there is no fuzzy or partial matching.

See also: Destination allowlist, Create an allowlist.